Privacy Policy

CareCompanion is the data controller for the personal data described here. For any privacy question, contact us at getcarecompanion@gmail.com or via getcarecompanion.com/contact.

We only collect what's needed to run the service. We do not use advertising, cross-app tracking, or ad-identifier SDKs. We do use a privacy-first product-analytics tool (PostHog) to collect the anonymous usage data described below; it does not track you across other apps or websites.

• Account information — your email address and the display name you provide (or that Apple provides when you use Sign in with Apple). If you choose "Hide My Email," we receive Apple's private relay address instead of your real email.
• Care data you enter (health information) — medications and dosages, medication logs, routines, activities, appointments, and health events (including notes, severity, and triggers). Some of this is health-related data.
• Information about the person you care for — CareCompanion is used by a caregiver to record information about another person (the care recipient), who is a separate individual under data-protection law. By entering their information you confirm you are authorised to do so — for example as their parent or legal guardian, under a power of attorney, or with their consent — and that you may share it with the care circle you choose. Where the care recipient is a child, you confirm you are their parent or guardian.
• Other content you create — recipes, diet plans, notes, and the messages you send to other members of your care circle.
• Care circle information — the email addresses you use to invite co-caregivers, and your relationships within a circle.
• Account identifier — a unique user ID we assign to your account.
• Subscription status — whether you have an active Premium subscription. Payments are processed by Apple (in-app purchases); we never receive or store your card details.
• Anonymous usage data. To understand which features are used and improve the app, we collect anonymous, aggregated usage events — for example, that a medication was added or a shift handover was posted. This never includes names, medication names, health-event details, notes, or anything you enter. It is linked only to a random internal account identifier, never your email or name. In the EEA and UK we ask permission before collecting any of it; elsewhere it is on by default. Either way you can turn it off anytime in Settings > Privacy > "Share anonymous usage data."

We do not collect your location, your device contacts/address book, or advertising identifiers.

Sharing within your care circle. Information you record is visible to the members you invite. The circle owner controls who is a member and each member's permissions (view-only or edit). Inviting someone gives them access to the care recipient's care plan, including health information. You are responsible for who you invite, and you can remove members and revoke access at any time.

We use your data solely to provide the app's functionality: to create and secure your account, store and sync your care plan, deliver reminders, enable messaging and care-circle sharing, and manage your subscription. We do not sell your data, use it for advertising, or share it with data brokers.

Health information (medications, doses, logs, routines, activities, appointments, and health events including notes, severity and triggers) is special-category data. We process it only with your explicit consent (GDPR Article 9(2)(a)), which you give by a clear affirmative action when you add this information. You can withdraw consent at any time by deleting the data or your account.

Non-health data (such as account information and subscription status) is processed to perform our contract with you or for our legitimate interests in operating and securing the app.

Analytics: in the EEA and UK, your consent (GDPR Article 6(1)(a)) — we ask when you first open the app and collect nothing until you agree; you can withdraw at any time using the in-app toggle. Outside the EEA and UK, our legitimate interest in understanding usage and improving the service, which you can object to at any time using the in-app opt-out. Either way, the toggle stops all collection.

We share data only with:

• Service providers who host and run the app on our behalf — primarily Supabase (database, authentication, and storage). They process data under our instructions and are bound by confidentiality and data-protection terms.
• Apple, for processing in-app subscription purchases.
• PostHog — privacy-first product analytics, hosted in the EU (Frankfurt). Receives only the anonymous usage events described above; no personal or health data.
• AI providers (OpenAI and Google, via our Lovable AI Gateway) — used only to turn a recipe photo or text you submit into a structured recipe. We send only the recipe content you provide; we do not send your health information, medications, or care-circle data to these providers. Processing may occur outside the EEA under EU Standard Contractual Clauses.
• People you choose — members of a care circle you create or join can see the care data and messages shared within that circle.

We may disclose data if required by law or to protect rights and safety.

We keep your data while your account is active. When you delete your account, we delete your personal data from our live systems immediately. Copies may remain in our infrastructure provider's encrypted backups until they are overwritten in the normal backup cycle, no later than 30 days. Anonymous usage analytics are linked only to a random internal identifier, never to your name or email. When you delete your account we delete that link, after which the remaining usage data can no longer be associated with you.

Data is encrypted in transit (HTTPS/TLS) and protected at the database level with row-level security so that you and your care circle can only access your own data. No method of transmission or storage is 100% secure, but we work to protect your information.

Depending on your location, you have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can exercise most of these directly in the app (edit, export, or delete), or contact us at getcarecompanion@gmail.com. You have the right to lodge a complaint with your local data-protection authority. In Sweden this is the Integritetsskyddsmyndigheten (IMY).

CareCompanion is intended for adult caregivers and is not directed to children. A caregiver may record care information about a child they care for; that information is treated as the caregiver's account data under this policy. We do not knowingly collect data directly from children under 13 (or the applicable age in your country).

Your data may be processed on servers located outside your country, including by our service providers. Where required, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) for these transfers. Analytics data (PostHog) is stored in the EU (Frankfurt).

We may update this policy from time to time. We'll revise the "Last updated" date above and, for material changes, provide notice in the app or by email.

Questions or requests: getcarecompanion@gmail.com · getcarecompanion.com/contact